Vulnerabilities > CVE-2008-0953 - Code Execution in RETIRED: HP Instant Support 'HPISDataManager.dll' ActiveX Control

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
hp
critical
nessus
exploit available

Summary

The StartApp function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary programs via a .exe filename in the argument, a different vulnerability than CVE-2007-5608 and CVE-2008-0953.

Vulnerable Configurations

Part Description Count
Application
Hp
1

Exploit-Db

descriptionHP Instant Support 1.0.22 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability. CVE-2008-0953. Dos exploit for windows platform
idEDB-ID:31876
last seen2016-02-03
modified2008-06-03
published2008-06-03
reporterDennis Rand
sourcehttps://www.exploit-db.com/download/31876/
titleHP Instant Support 1.0.22 - 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability

Nessus

NASL familyWindows
NASL idHPISDATAMANAGER_ACTIVEX_1_0_0_24.NASL
descriptionThe remote host contains several ActiveX controls in HP Instant Support HPISDataManager.dll, a web-based diagnostic tool from Hewlett-Packard. The version of the controls installed on the remote host reportedly are affected by several issues. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, this method could be used to execute arbitrary code by means of buffer overflows or to execute delete, download, and write to arbitrary files on the affected system, all subject to the user
last seen2020-06-01
modified2020-06-02
plugin id33095
published2008-06-05
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/33095
titleHP Instant Support HPISDataManager.dll ActiveX Control < 1.0.0.24 Vulnerabilities
code
#
#  (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description)
{
  script_id(33095);
  script_version("1.18");

  script_cve_id(
    "CVE-2007-5604",
    "CVE-2007-5605",
    "CVE-2007-5606",
    "CVE-2007-5607",
    "CVE-2007-5608",
    "CVE-2007-5610",
    "CVE-2008-0952",
    "CVE-2008-0953"
  );
  script_bugtraq_id(
    29529, 
    29530, 
    29531, 
    29532, 
    29533, 
    29534, 
    29535, 
    29536
  );
  script_xref(name:"Secunia", value:"30516");

  script_name(english:"HP Instant Support HPISDataManager.dll ActiveX Control < 1.0.0.24 Vulnerabilities");
  script_summary(english:"Checks version of HPISDataManager.dll control");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has several ActiveX controls that are affected
by multiple vulnerabilities." );
 script_set_attribute(attribute:"description", value:
"The remote host contains several ActiveX controls in HP Instant
Support HPISDataManager.dll, a web-based diagnostic tool from
Hewlett-Packard. 

The version of the controls installed on the remote host reportedly
are affected by several issues.  If an attacker can trick a user on
the affected host into viewing a specially crafted HTML document, 
this method could be used to execute arbitrary code by means of
buffer overflows or to execute delete, download, and write to
arbitrary files on the affected system, all subject to the user's
privileges." );
 script_set_attribute(attribute:"see_also", value:"http://www.csis.dk/dk/forside/CSIS-RI-0003.pdf" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Jun/29" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Jun/26" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to HP Instant Support version 1.0.0.24 or later." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_cwe_id(94);
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/06/05");
 script_set_attribute(attribute:"patch_publication_date", value: "2008/06/03");
 script_cvs_date("Date: 2018/11/15 20:50:27");
 script_set_attribute(attribute:"plugin_type", value:"local");
 script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:instant_support");
 script_end_attributes();

 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}


include("global_settings.inc");
include("smb_func.inc");
include("smb_activex_func.inc");


if (!get_kb_item("SMB/Registry/Enumerated")) exit(0);


# Locate the file used by the controls.
if (activex_init() != ACX_OK) exit(0);

clsid = "{14C1B87C-3342-445F-9B5E-365FF330A3AC}";
file = activex_get_filename(clsid:clsid);
if (file)
{
  ver = activex_get_fileversion(clsid:clsid);
  if (ver && activex_check_fileversion(clsid:clsid, fix:"6.0.10.50") == TRUE)
  {
    report = NULL;
    if (report_paranoia > 1)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Note, though, that Nessus did not check whether the kill bit was\n",
        "set for the control's CLSID because of the Report Paranoia setting\n",
        "in effect when this scan was run.\n"
      );
    else if (activex_get_killbit(clsid:clsid) == 0)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Moreover, its kill bit is not set so it is accessible via Internet\n",
        "Explorer.\n"
      );
    if (report)
    {
      if (report_verbosity) security_hole(port:kb_smb_transport(), extra:report);
      else security_hole(kb_smb_transport());
    }
  }
}
activex_end();